Stop shipping bitcoin products to your home

There are many bitcoin products you may want to buy; bitcoin signing devices (hardware wallets), seed backup tools, pre-assembled bitcoin nodes...

Some products are generic and can be bought from ordinary merchants without any particular privacy concerns (normal phones, laptops), but for products specific to bitcoin the existing default of shipping to your home address is dangerous.

The seller may be malicious and use your private data to $5 wrench attack you, or their database (which includes your data) may be compromised and ultimately sold online.

This article explores the key challenges associated with selling physical bitcoin products and seeks to offer some suggestions for how these challenges can be met.

The problem with shipping to a residential address

Frequently a seller will keep shipping data on file to streamline the checkout experience for future purchases. If this data is hacked the buyer is unable to patch the leak short of moving home, in which case the risk of $5 wrench attack moves to the unassuming home buyer.

The risk can be partially mitigated if the seller automatically deletes all user data once the shipment has been successfully received, but even then there are often 3rd parties who hande this data along the way and there is no way to guarantee data deletion.

It is best to avoid this entirely by sign an alternate shipping method;

Mailbox

A buyer can use a mail forwarding service or PO box They register with the mail forwarding company who provides them with a shipping address which they provide to the seller. Mail sent by the seller to this address is automaticaly forwarded to the buyers primary (residential) address. This action can be taken by buyers today.

In-Person Purchase

A buyer can attend a bitcoin conference to buy hardware directly from a vendor in person with no shipping required.

Non-residential Address

A buyer could arrange for delivery to a trusted location such as a workplace, or the workplace of a friend or family. To enable this sellers should use discrete packaging which doesn't draw attention and offer methods of shipping in which all taxes and fees are paid upfront by the buyer to avoid complications on delivery.

Don't use your main email for order updates

When placing an online order for a physical product is typical for the buyer to provide their email address at the time of purchase.

Buyers like to receive updates as their order is processed (e.g. when the product is dispatched). Many buyers will have push notifications on their phone for email, so these updates are effortlessly received and read without any proactive steps required.

If the seller maintains a record of the email beyond the product has shipped they have a persistent communications channel direct with their customer. Because people rarely change email address they can most probably use this communications channel in the future, e.g. to announce a new product or a sale.

The problem with email order updates

The seller (or a 3rd party software company acting on behalf of the seller) must maintain records of their customer email addresses in order to communicate with them. All too often companies fail to secure this data and it becomes publicly accessible or available to purchase.

If this data is hacked the buyer is unlikely to patch the leak (people rarely change email addresses).

The risk can be partially mitigated if the seller automatically deletes all user data once the shipment has been successfully received. Again, there is no way to guarantee this so simply avoid exposing this data at any point;

Email Aliasing

A buyer can use an email aliasing service such as simplelogin. They generate a unique email address and provide this to the seller. Emails sent by the seller to the unique email address are automaticaly forwarded to the buyers primary email address. This action can be taken by buyers today.

Account Model

The seller can generate a unique account code which is given to the buyer at the time of purchase. The buyer can enter this code on the sellers website to check the status of their order. The codes are one time use. This model was pioneered by VPN provider Mullvad but it has yet to be seen more widely. T

he tradeoff is that the buyer has full responsibility for recording their account code, and they have to actively check for shipping updates. Alsom if the code is lost it may be hard / impossible for the seller to verify the buyer and re-issue the code.

Did I miss something? Message me @orangesurfbtc